6e516faf04
For a while now it's been allowed for a MMU context to outlive it's
corresponding panfrost_priv, however the job structure still references
panfrost_priv to get hold of the MMU context. If panfrost_priv has been
freed this is a use-after-free which I've been able to trigger resulting
in a splat.
To fix this, drop the reference to panfrost_priv in the job structure
and add a direct reference to the MMU structure which is what's actually
needed.
Fixes: 7fdc48cc63 ("drm/panfrost: Make sure MMU context lifetime is not bound to panfrost_priv")
Signed-off-by: Steven Price <steven.price@arm.com>
Acked-by: Alyssa Rosenzweig <alyssa.rosenzweig@collabora.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20220519152003.81081-1-steven.price@arm.com
48 lines
1.3 KiB
C
48 lines
1.3 KiB
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
/* Copyright 2019 Collabora ltd. */
|
|
|
|
#ifndef __PANFROST_JOB_H__
|
|
#define __PANFROST_JOB_H__
|
|
|
|
#include <uapi/drm/panfrost_drm.h>
|
|
#include <drm/gpu_scheduler.h>
|
|
|
|
struct panfrost_device;
|
|
struct panfrost_gem_object;
|
|
struct panfrost_file_priv;
|
|
|
|
struct panfrost_job {
|
|
struct drm_sched_job base;
|
|
|
|
struct kref refcount;
|
|
|
|
struct panfrost_device *pfdev;
|
|
struct panfrost_mmu *mmu;
|
|
|
|
/* Fence to be signaled by IRQ handler when the job is complete. */
|
|
struct dma_fence *done_fence;
|
|
|
|
__u64 jc;
|
|
__u32 requirements;
|
|
__u32 flush_id;
|
|
|
|
struct panfrost_gem_mapping **mappings;
|
|
struct drm_gem_object **bos;
|
|
u32 bo_count;
|
|
|
|
/* Fence to be signaled by drm-sched once its done with the job */
|
|
struct dma_fence *render_done_fence;
|
|
};
|
|
|
|
int panfrost_job_init(struct panfrost_device *pfdev);
|
|
void panfrost_job_fini(struct panfrost_device *pfdev);
|
|
int panfrost_job_open(struct panfrost_file_priv *panfrost_priv);
|
|
void panfrost_job_close(struct panfrost_file_priv *panfrost_priv);
|
|
int panfrost_job_get_slot(struct panfrost_job *job);
|
|
int panfrost_job_push(struct panfrost_job *job);
|
|
void panfrost_job_put(struct panfrost_job *job);
|
|
void panfrost_job_enable_interrupts(struct panfrost_device *pfdev);
|
|
int panfrost_job_is_idle(struct panfrost_device *pfdev);
|
|
|
|
#endif
|